# Anyone can create Proposal Unigov Proposal-Store.sol

Proposal-Store.sol's AddProposal lacked access control, letting anyone inject proposals that GovernorBravoDelegate would queue and execute without voting.

- Payout: Audit contest
- Severity: high
- Program: Canto
- Found by: Soosh
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-newblockchain-findings/issues/26
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-canto%3AH-07
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:auth-bypass vuln:governance

**Target:** Unigov Proposal-Store.sol / GovernorBravoDelegate governance contracts
**Root cause:** AddProposal() in Proposal-Store.sol has no authorization check, so any address can append arbitrary proposals to the store that the governor treats as already-passed.
**Steps:**
1. Identify Proposal-Store.sol AddProposal() at L46 with no access control.
2. Call `AddProposal(...)` from an arbitrary EOA to insert a malicious proposal into the store mapping.
3. Call GovernorBravoDelegate queue/execute for that proposal id, which is permissionless.
4. Proposal executes arbitrary governance actions without any vote.
**How found:** Code review of the governance flow: noticed ProposalStore is meant to hold only passed proposals, but AddProposal had no caller restriction while the governor's queue/execute is open to anyone.
**Exploitation:** Attacker directly calls AddProposal to register a crafted proposal, then invokes the permissionless queue/execute path in GovernorBravoDelegate to run it, achieving arbitrary governance execution without voting.
**Insight:** When a store contract is documented as 'only written by the governance module,' verify the writer function actually enforces that; pair it with any permissionless queue/execute path to get full governance bypass.